# What is Anomaly Detection? A Complete Guide *Complete guide* **Anomaly detection** is the continuous process of monitoring network activity, establishing a baseline of normal behavior, and automatically flagging deviations that signal a threat, misconfiguration, or attack in progress—focused on the DNS and DHCP layers where every attacker leaves a trace. --- ## Why it matters ### Why does anomaly detection matter? Signature-based detection catches what's already been cataloged. Threat feeds block what's already been reported. Both are reactive by design—while sophisticated attackers operate in the gap between first seen and first published. Since DNS and DHCP are the first infrastructure layers every device (and every attacker) interacts with, anomaly detection at the **DDI layer** gives your security stack the earliest possible warning signal to work with. #### Known attack: Domain generation algorithms (DGA) Generate thousands of throwaway domains no feed has indexed yet. #### Known attack: DNS tunneling Exfiltrates data through query payloads that no rule was written to catch. #### Known attack: DHCP starvation attack Exhausts IP pools silently before any alert fires. #### Known attack: Subdomain enumeration Maps internal infrastructure through a flood of recursive queries. #### Known attack: Rogue devices Acquire leases and pivot laterally before they're ever noticed. #### The blind spot Every one of these techniques exploits the blind spot that exists when detection depends entirely on known-bad signatures. --- ## How it works ### How does anomaly detection work? The engine learns your network's normal behavior, watches every DNS query and DHCP transaction against that baseline in real time, and automatically contains anything that crosses the line. ### The six-stage detection loop **Baseline → Detect → Score → Contain → Validate → Refine** 1. **Baseline learning** The engine observes your environment's normal rhythms—DNS query volumes, domain diversity, query type distributions, lease patterns, and client-to-subnet relationships—and builds a living model of what normal looks like. 2. **Real-time event analysis** Every DNS query and DHCP transaction is measured against that baseline the moment it arrives. Spikes, abnormal frequencies, and high-entropy domains are flagged immediately. 3. **Severity scoring** Every flagged event is scored from 0 to 100 across four severity levels—Low, Medium, High, and Critical—weighing confidence and potential damage. 4. **Automated quarantine** When an anomaly crosses your configured severity threshold, the engine takes containment action automatically—no manual intervention required. 5. **Investigation and validation** Every quarantined entity lands in a unified dashboard with full context. Admins review evidence, validate the call, and release legitimate entities. 6. **Feedback and refinement** Every validated anomaly and confirmed false positive feeds back into the baseline, making each detection cycle sharper than the last. --- ## DNS anomalies ### What are DNS anomalies? DNS anomalies are deviations in query behavior that point to malicious activity, protocol abuse, or infrastructure reconnaissance. DNS is queried by every device before it communicates—making it the most comprehensive visibility point in your security stack. #### DGA activity Malware programmatically generates random-looking domain names, querying them rapidly until one resolves to a C2 server. High entropy and volume form a detectable pattern well before feeds catch up. #### DNS tunneling Attackers encode data inside DNS query payloads—unusually long subdomains or uncommon record types like TXT and NULL—to exfiltrate data or maintain a covert C2 channel. #### Subdomain enumeration A rapid burst of subdomain queries used to map internal infrastructure. Detectable through volume spikes against a single parent domain in a compressed timeframe. #### Query type anomalies Unusual concentrations of specific record types—excessive TXT, ANY, or NULL queries—that deviate from established distributions and indicate protocol abuse or reconnaissance. #### RCODE anomalies Abnormal volumes of response codes—particularly NXDomain—indicating scanning activity, misconfigured clients, or DGA-infected endpoints. #### Windows-specific DNS anomalies Behavioral deviations specific to Windows environments: abnormal dynamic update activity, unusual WINS lookups, and off-norm query behaviors. --- ## DHCP anomalies ### What are DHCP anomalies? DHCP anomalies are deviations in lease request and allocation behavior that indicate rogue devices, misconfigured clients, or deliberate attacks against IP address infrastructure. 1. **DHCP starvation** An attacker floods the DHCP server with lease requests using spoofed MAC addresses, exhausting the IP pool and denying legitimate devices access. 2. **Duplicate IP address** Multiple devices claiming the same IP, indicating either a misconfiguration or a deliberate address conflict attack. 3. **Rapid lease cycling** A client requesting and releasing leases at abnormally high frequency—a signature of flood tools, faulty stacks, or deliberate churn. 4. **Stale lease detection** Leases held by devices no longer active—ghost devices, improper decommissioning, or zombie endpoints that represent an unmonitored footprint. 5. **Multiple IPs per MAC** A single MAC acquiring leases across multiple subnets, signalling lateral movement, misconfiguration, or unauthorized network behavior. 6. **DHCPv6-specific anomalies** The DHCPv6 equivalents: duplicate DUIDs, duplicate IAIDs, and rapid flooding against IPv6 lease infrastructure. --- ## Real-time detection ### What is real-time anomaly detection? - **Inline, not retrospective** Every DNS query and DHCP transaction is analyzed as it flows through the network—not after logs are written. - **Attacks move in seconds** A DGA can query hundreds of domains per second; DHCP starvation can drain a pool in minutes. Batch log analysis is always behind. - **Immediate scoring** Deviations are scored the moment they arrive, so the dashboard reflects your current threat posture—not what it looked like an hour ago. - **Automatic containment** Quarantine triggers inline, compressing the window between first anomalous behavior and containment from hours to moments. --- ## Benefits ### Benefits of anomaly detection Anomaly detection turns raw network noise into early, actionable signal. Here's what that shift delivers for security and compliance teams. - **Catch threats before they're cataloged** Behavioral detection identifies DGA, tunneling, and enumeration activity the day threats emerge—not the day they receive a CVE. - **Automated quarantine, zero manual delay** Suspicious clients and domains are isolated the moment they cross your severity threshold. - **Unified DNS and DHCP visibility** DNS and DHCP anomalies correlated in a single dashboard—no toggling between tools. - **Evidence-driven investigation** Every flagged entity comes with forensic context: anomaly type, severity, timestamp, query trail, and affected entities. - **Progressive accuracy over time** Every validated detection and confirmed false positive feeds back into the baseline, reducing alert fatigue. - **Compliance-ready reporting** Time-bound, filterable anomaly reports as PDF or CSV, with configurable retention up to three years for GDPR, HIPAA, PCI DSS. - **Complete network coverage** Every device using DNS or DHCP is covered—IoT, BYOD, infrastructure nodes—without endpoint agents. --- ## What to look for ### What to look for in a solution Not every anomaly detection tool is built for the DNS and DHCP layer. These are the capabilities that separate a purpose-built solution from a repurposed log analyzer. - **Dual-engine detection** Rule-based coverage combined with AI/ML behavioral analysis in a single pipeline. - **Real-time processing** Inline analysis at the moment of query or transaction—not batch log review. - **Unified DNS and DHCP** Both protocol layers monitored natively in one platform, not stitched together. - **Automated severity scoring** 0–100 scoring with configurable quarantine thresholds and severity bands. - **OS-aware quarantine** Containment mechanisms tuned for Windows and Linux endpoints alike. - **Forensic dashboards** Drill-down into domains, clients, and full query trails for investigation. - **False positive workflow** Validation and release actions so legitimate entities aren't held in quarantine. - **Configurable retention** Report retention windows tuned to audit and compliance requirements. --- ## DDI Central ### How ManageEngine DDI Central helps DDI Central brings DNS, DHCP, and IP address management together in a single platform—running anomaly detection natively across both protocol layers with automated scoring, quarantine, and investigation built in. ### Dual-engine detection #### Rules plus Zia AI, running in parallel DDI Central's anomaly detection engine runs on two parallel tracks: a comprehensive library of built-in detection rules covering known DNS and DHCP anomaly types, plus Zoho's Zia AI engine applying machine learning to catch behavioral threats—including DGA patterns—that no rule has been written for yet. Every detected anomaly is scored 0 to 100 across Low, Medium, High, and Critical bands. - Built-in rule library for known anomalies - Zia AI/ML for unknown behavioral threats - 0–100 severity scoring across 4 bands **Key metrics** - Rule engine coverage: 40+ types - AI models: Zia ML - Severity bands: 4 ### Anomaly Insights dashboard #### Live command center for anomaly management The Anomaly Insights dashboard surfaces total anomaly volume, severity distribution, trend curves, top flagged domains, top suspicious DNS clients, and top misbehaving DHCP endpoints across every site and cluster. Every panel drills down to full forensic detail with a single click. - Severity distribution and trend curves - Top flagged domains and clients - One-click drill-down to forensics **Key metrics** - Refresh cadence: Real-time - Site coverage: Multi-cluster - Drill-down: 1 click ### Automated quarantine #### OS-aware containment, no manual trigger When an anomaly crosses the configured severity threshold, the offending entity is quarantined automatically: - DNS clients via Client Subnet restriction on Windows or ACL blocking on Linux - Flagged domains via DNS Firewall on both - DHCP clients via MAC filtering on Windows or restrictive reservation on Linux - OS-appropriate containment on Windows and Linux - DNS Firewall for flagged domains - No manual trigger—automatic on threshold **Key metrics** - Trigger: Auto - OS support: Win + Linux - Response time: < 1s ### Anomaly reports #### Time-bound, filterable, audit-ready The Reports module provides time-bound, filterable views of all DNS and DHCP anomaly activity, with chart visualizations, drill-down tables, and granular filters across anomaly category, severity, domain, client IP, subnet, and cluster. Export as PDF or CSV; retention configurable from 30 days to three years. - Filter by category, severity, domain, client, subnet, cluster - Export to PDF or CSV - Retention from 30 days to 3 years **Key metrics** - Formats: PDF · CSV - Retention: 30d — 3y - Filters: 6 axes --- ## FAQ ### Frequently asked questions #### What is the difference between anomaly detection and threat intelligence? Threat intelligence operates on known indicators—it blocks domains, IPs, and URLs already classified as malicious by external feeds. Anomaly detection operates on behavior—it flags activity that deviates from your network's established baseline, regardless of whether the specific threat has ever been seen before. Threat intelligence catches what's already been cataloged; anomaly detection catches what hasn't. Used together, they eliminate both the known-threat and zero-day blind spots simultaneously. #### Can anomaly detection catch zero-day threats? Yes—this is precisely where anomaly detection has an advantage over signature-based tools. Zero-day threats, by definition, have not yet been cataloged. Anomaly detection identifies that something shouldn't be happening—a client querying hundreds of high-entropy domains per second, a MAC address acquiring leases across multiple subnets, a flood of NXDomain responses from a single endpoint—and flags it based on behavioral deviation alone. The specific threat doesn't need to have a name yet. #### What DNS anomalies are most commonly seen in enterprise networks? The most frequently observed are DGA activity from malware-infected endpoints, DNS tunneling used for data exfiltration or C2, subdomain enumeration from reconnaissance, and elevated NXDomain response rates from misconfigured or compromised clients. DGA and tunneling carry the highest risk—both are designed to fly under signature-based radar and can persist unnoticed without behavioral monitoring. #### How is DHCP anomaly detection different from DHCP monitoring? Standard DHCP monitoring tracks lease allocation, pool utilization, and server health—operational metrics focused on availability. DHCP anomaly detection goes deeper, analyzing behavioral patterns of individual clients: request frequency, multi-subnet acquisition, identifier collisions, and lease cycling patterns matching known attack signatures like starvation or rapid-release flooding. Operational visibility versus security intelligence—both matter. #### What happens after an anomaly is automatically quarantined? Automatic quarantine isolates the flagged entity immediately, blocking DNS resolution for suspicious domains or restricting network access for suspicious clients while preserving full forensic detail. Quarantined entities appear in the Insights dashboard with anomaly type, severity, timestamp, and the behavioral evidence that triggered containment. Administrators review, validate or dismiss the quarantine, and release legitimate entities with a single action. The threshold itself is configurable.